[ale] [Fwd: IETF Draft on Transmission Control Protocol securityconsiderations]

[Greg]

This is on the OpenBSD list a lot also - but it is of concern to Cisco and
their ilk.  What's broken is Cisco and their gear.  More corporate FUD,
though since a great many place their undying trust in Cisco, I guess it is
a threat to those that have an all Cisco network.  Also was mentioned in the
OpenBSD posts was how Cisco's training only looked at one aspect of the
problem and how the other aspects have come home to roost.  Funny how there
is no mention of Cisco or others in the post - and this is what makes it
seem like it's an "everyone in the world" issue.

Greg

> -----Original Message-----
> From: ale-bounces at ale.org [mailto:ale-bounces at ale.org]On Behalf Of
> Geoffrey
> Sent: Wednesday, April 21, 2004 1:22 PM
> To: ALE
> Subject: [ale] [Fwd: IETF Draft on Transmission Control Protocol
> securityconsiderations]
>
>
> Of interest:
>
> -------- Original Message --------
> Subject: IETF Draft on Transmission Control Protocol security
> considerations
> Date: Tue, 20 Apr 2004 17:47:06 -0700
> From: Thor Larholm <thor at pivx.com>
> To: <bugtraq at securityfocus.com>, <ntbugtraq at listserv.ntbugtraq.com>
>
> >From the Abstract:
>
>     TCP (RFC793 [1]) is widely deployed and one of the most often used
>     reliable end to end protocols for data communication. Yet when it was
>     defined over 20 years ago the internet, as we know it, was a
>     different place lacking many of the threats that are now common.
>     Recently several rather serious threats have been detailed that can
>     pose new methods for both denial of service and possibly data
>     injection by blind attackers. This document details those threats and
>     also proposes some small changes to the way TCP handles inbound
>     segments that either eliminate the threats or at least minimize them
>     to a more acceptable level.
>
> http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcpsecure-00.txt
>
>
> This is in response to Technical Cyber Security Alert TA04-111A
>
> http://www.us-cert.gov/cas/techalerts/TA04-111A.html
>
>
>
>
> Regards
>
> Thor Larholm
> Senior Security Researcher
> PivX Solutions
> 24 Corporate Plaza #180
> Newport Beach, CA 92660
> http://www.pivx.com
> thor at pivx.com
> Phone: +1 (949) 231-8496
> PGP: 0x5A276569
> 6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569
>
> PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
> Qwik-Fix
> <http://www.qwik-fix.net>
>
>
>
>
>
> --
> Until later, Geoffrey                     Registered Linux User #108567
> Building secure systems in spite of Microsoft
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>